Forwarded messages with "ATT000x.htm", same file hash - as Malware/Reputation

The past two weeks have shown a high number of email filtered as malware/reputation but still got delivered to users inbox. Checked further and realized it's as a result of a particular hash file com...